Why This Audit Was Done
13
pages
English
Documents
Le téléchargement nécessite un accès à la bibliothèque YouScribe Tout savoir sur nos offres
13
pages
English
Documents
Le téléchargement nécessite un accès à la bibliothèque YouScribe Tout savoir sur nos offres
February 11, 2010 Risk Management Self-Insurance Programs Controls have been established over the Sam M. McCall, Ph.D., CPA, CGFM, CIA, CGAP claims disbursements and collections of City Auditor the self-insurance programs to protect and safeguard City assets. HIGHLIGHTS Highlights of City Auditor Report #1010, a report to the City Commission and City management WHY THIS AUDIT WAS DONE WHAT WE RECOMMENDED The purpose of this audit was to address the While controls have been established over claims processes established by the City Treasurer-Clerk disbursements and collections related to the self-and Risk Management to administer and oversee insurance programs to protect and safeguard City assets, the City’s self-insurance programs including we made recommendations in the following areas where general, vehicle accident, and Workers’ controls could be strengthened and operations improved: Compensation liability. Transactions related to • Performance of periodic reconciliations of the data 5,031 self-insurance claims were processed by Risk recorded in the involved systems in order to identify Management between October 1, 2005, and March and correct any discrepancies in a timely manner. 31, 2009, resulting in Risk Management disbursements in excess of $7.6 million and • Establishment of controls over the receipt of all subrogation collections of more than $1.1 million. ...
Voir
Publié par
Langue
English
Sam M. McCall, Ph.D., CPA, CGFM, CIA, CGAP City Auditor HIGHLIGHTSHighlights of City Auditor Report #1010, a report to the City
Februar 11, 2010 Risk Management Self-Insurance Programs Controls have been established over the claims disbursements and collections of the self-insurance programs to protect and safeguard City assets.
WHAT WE RECOMMENDED While controls have been established over claims disbursements and collections related to the self-insurance programs to protect and safeguard City assets, we made recommendations in the following areas where controls could be strengthened and operations improved:
•Performance of periodic reconciliations of the data recorded in the involved systems in order to identify and correct any discrepancies in a timely manner.
•Establishment of controls over the receipt of all checks to provide for timely processing and deposit of all collections.
•Re-evaluation of risks associated with the lack of segregation of duties due to the sharing of the system administrator user identification numbers and passwords in the RiskMaster system and the established compensating controls.
•
•
Analysis and correction of any overpayments/ underpayments made to City departments during the past two years resulting from inappropriate recording of Electric department third party vehicle accident losses.
Consideration by the City Treasurer-Clerk and DMA of corrective actions necessary to adopt a transparent and equitable methodology to account for, and distribute to applicable departments, subrogation collections for losses to City property and vehicles sustained as a result of third party vehicle accidents.
•Evaluation of the benefits of the contributions of an active Insurance Advisory Board (IAB) and consideration of changes to City Commission Policy 216 to more accurately reflect the process in place to procure commercial insurance. •Development and implementation of quantifiable performance measures to assist in evaluating and reporting the efficiency and effectiveness of the risk management function. Such measures should include consideration of resource requirements (inputs), and efficiency and effectiveness measures. ______________________________Office of the City Auditor
February 11, 2010
1
RiskManagementSelf-InsurancePrograms
Report #1010
Sam M. McCall, Ph.D., CPA, CGFM, CIA, CGAP City Auditor
AuditReport
Audit Report #1010
The scope of this audit included a review of the processes established by the City Treasurer-Clerk and Risk Management to administer and oversee the City’s self-insurance programs for general and vehicle liability. Additionally, the audit focused on a review of the administration and reliability of data recorded in the RiskMaster system, the system used to account for self-insured claims transactions. The objectives of this audit were to obtain an understanding of the risk management program’s goals, objectives, processes, and activities sufficient to: Evaluate selected internal controls over claims, • cash disbursements, and collections related to the City’s self-insurance programs, •Evaluate selected controls over claims processing and reporting in the RiskMaster system and determine reliability of data recorded in the system through reconciliation of the payments and collections recorded in the system to data reported in two of the City’s major financial reporting systems. •Identify potential cost efficiencies and service improvements in the risk management process. Our methodology included interviewing Risk Management staff to gain an understanding of the risk management process and identifying and testing claims payments and collections recorded in the RiskMaster system during the audit period, October 1, 2005, through March 31, 2009, for assurance that payments were accurately recorded and appropriately approved and collections were timely and accurately recorded and deposited. We reviewed system data and supporting documentation to reconcile the Risk Management accounting system, RiskMaster, to the City’s two major financial reporting systems. Samples of payments and collections were tested for general claims and vehicle accident claims. As an audit of Workers’ Compensation claims was conducted by the State of Florida, Department of Financial Services, Division of Workers’ Compensation, in June 2009, testing of Workers’ Compensation claims was omitted from this audit. The State of Florida audit of the City’s Workers’ Compensation activities included testing of the benefit disbursement practices, electronic data accuracy practices, and case management techniques. No significant deficiencies were noted in the State of Florida audit report number 08/09-056, issued for the period August 7, 2004, through June 18, 2009.
2
Risk Management Self-Insurance Programs
Claims files were also reviewed to determine that activities of the independent third party administrator (Crawford) and the claims field investigative service provider (York), the companies providing independent investigative activities for claims as necessary, were within the scope of City of Tallahassee contracts and that sufficient documentation was available to support payments made to these entities. We conducted this audit in accordance with the International Standards for the Professional Practice of Internal Auditing and Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
The Risk Management division, within the Treasurer-Clerk’s Office, is responsible for the administration of the City’s self-insured programs, including general, vehicle accident, Workers’ Compensation, and employment practice liability. Additionally, the division is responsible for the procurement and administration of commercially purchased insurance for all other applicable City exposures. To accomplish the responsibilities of the division, as of March 31, 2009, Risk Management was assigned the following seven full-time equivalent positions shown in the organization chart in Figure 1.
Figure 1 Risk Management Organization Chart
W o r k e r s ’ C o m p e n s a t i o n E x a m i n e r
A d m i n i s t r a t i v e S p e c ia l i s t I
C i t y T r e a s u r e r - C l e r k
D e p u t y T r e a s u r e r -C l e r k
R i s k M a n a g e r
S u p e r v i s o r - R i s k M a n a g e m e n t S y s t e m s a n d S e r v ic e s A d m i n is t r a t i v e S p e c i a l is t I
S t a f f A d ju s t e r
R i s k M a n a g e m e n t S p e c i a li s t
Risk Management Self-Insurance Programs The City additionally has a Safety Administrator position organizationally located outside of Risk Management, within the Human Resources department, that reports directly to the head of Human Resources. The responsibilities of that position include providing direction, guidance, and oversight for the City’s comprehensive safety and health programs and developing, administering, and overseeing a Citywide occupational safety and health program including responsibility for the criminal and driver history assessment function and workplace violence mitigation. The individual in this position serves on the Serious Accident Review Committee and the Emergency Management Team. The Safety Administrator coordinates loss prevention initiatives with Risk Management and interacts, as needed, with Risk Management on issues related to employee safety and City accidents.
Risk Management Fund A Risk Management Fund was created by City Commission Policy 214,- Risk Management/Self-Insurance Policy, for the sole purpose of providing resources needed to pay all anticipated claims and judgments against the City. It is funded on an annual basis sufficient to meet anticipated and projected claims payments, claims reserves, and any deficits for prior periods. The City’s FY 2009 budget reported $9,344,094 as the approved funding for the Risk Management Fund.
Special Insurance Reserve Fund
Additionally, a Special Insurance Reserve Fund was established and funded to meet unanticipated losses from catastrophic events, higher than expected claims experienced in a given year, or to meet other claims/resource needs in excess of the Risk Management Fund. The level of funding for this fund is set at the higher of 150% of the average for the past three years claims costs, or $3,000,000. Any drawdown of that fund below this level is to be replenished in the next budget cycle(s). At the end of FY 2008, the Special Insurance Reserve Fund balance was $6,771,937, an amount sufficient to meet the funding requirements described above. See Table 1 below.
Table 1 Special Insurance Reserve Fund
Fund Balance at September 30, 2008 $6,771,937
Three-Year Average of Claims Cost (2006, $3,874,333 2007 & 2008) (1) 150% x the past three years claims cost $5,811,500 Note (1): The three-year average cost data was compiled from information in the RiskMaster system.
Audit Report #1010
Self-Insurance Programs City Commission Policy 214 Risk Management / Self Insurance Policy, adopted July 12, 1991, authorized and created a self-insurance program for the City and established a uniform and centralized self-insurance system to provide coverage and funding for claims that have traditionally been insured through the commercial insurance market. This policy applies to all claims (i.e., requests for indemnification of loss by a third-party for damages alleged to have been caused by the City or one of its agents, or, the term “claim may also be used to refer to the estimated value or amount of a loss) against the City, its Commissioners, officials, employees, or appointed board or committee members which may arise while acting lawfully within the scope of their duties and employment. Risk Management has the responsibility for the administration and oversight of the claims administration process for the City’s self-funded exposures. In the administration of the self-insurance programs, Risk Management processes transactions (i.e., both payments of claims against the City and collection of funds due the City when the City is not at fault in accidents) related to the settlement of claims. During our audit period, October 1, 2005, through March 31, 2009, Risk Management processed transactions on a total of 5,031 open claims. Payments were made and collections received on general liability, vehicle accident, and Workers’ Compensation claims during the audit period as noted below in Table 2.
Table 2 Self-Insurance Claims October 1, 2005, through March 31, 2009 Number of Payments on Collections on Claims Claims Open Claims Open Open during the during the Audit during the Audit Period Period Audit Period
General Claims 2,592 $2,499,517 $810,660
Vehicle Accident Claims
Workers’ Compensation Claims
TOTAL
3
1,306 $1,953,647 $281,452
1,133 $3,185,625
5,031 $7,638,789
$51,722
$1,143,834
Audit Report #1010 To ensure that Risk Management is aware of all incidents that may represent a potential loss to the City, procedures have been established to inform City employees of their responsibilities to immediately report any accident (regardless of damage or injuries) to their direct supervisors. The supervisor (or employee, if the supervisor cannot be reached) must ensure that all incidents or accidents reported by the public or by employees are immediately reported to the Risk Management office. After-hours telephone numbers are available to employees to report incidents that may occur after the end of the workday or on the weekends and specific reporting procedures are in place for each type of incident that may occur. The after-hours calls may be received by the City Safety Administrator as well as by appointed Risk Management staff.
Claims Field Investigative Service Provider
Risk Management currently contracts with York Claims Services, Inc., a claims field investigative service provider (service provider), to investigate and handle claims filed against the City. The organization provides independent investigative services on a case-by-case basis as requested by Risk Management, and is paid an hourly fee for the specific services provided. All cases requiring direct work with claimants are referred to the service provider, as the service provider does all of the fieldwork on the claims (i.e., research, interviews with claimants or related parties, observations of property damage/accident sites, photographs, etc.). Additionally, Risk Management staff and/or the City Safety Administrator may also be called to the scene of an accident when it occurs. While the service provider does not directly negotiate settlement of claims, the service provider, at the direction of Risk Management, may be involved in the negotiation of a claim settlement within boundaries set by Risk Management. For each case referred to the service provider, Risk Management provides specific instructions (i.e., an assignment sheet) indicating the specific work to be performed.
Subrogation
Subrogation is a term used in the insurance industry to describe an insurance carrier’s right to recover monies paid to, or on behalf of, its policy holder. In conjunction with the City’s self-insurance programs, Risk Management pursues recovery and subrogation against third parties responsible for damaging City assets. As noted above in Table 2, more than $1.1 million was recovered during our audit period through efforts of the Risk Management staff.
Appendix B illustrates Risk Management’s current process to collect/recover and account for subrogation
Risk Management Self-Insurance Programs
funds. Risk Management receives and deposits collections into the Other Miscellaneous Revenue account and provides the Budget Division with a listing of collections to allow the allocation of the collections to each department. NOTE: Currently there is an audit recommendation outstanding relating to allocating Risk Management costs (Audit Report #0903, Allocated Costs, dated December 9, 2008, pages 31 through 35). The report notes statistics were misinterpreted resulting in inaccurate cost allocations to departments (i.e., undercharges or overcharges). RiskMaster System RiskMaster is the accounting system used by Risk Management to account for and accumulate data for the self-insurance programs. Risk Management contracts with the Computer Science Corporation (CSC) to host and maintain the RiskMaster system. All incidents that are reported to Risk Management and all transactions (i.e., correspondence, payments, and collections) related to any general, vehicle accident, or Workers’ Compensation claim are recorded directly into RiskMaster. In addition to testing various transactions recorded in RiskMaster for accuracy and completeness, we also reconciled the data recorded in RiskMaster to the data recorded in two of the City’s major accounting systems, the PeopleSoft Financials system and the CORE cashiering system. Commercially Purchased Insurance City Commission Policy 216 Insurance Procurement Policy, allows the City to procure commercial property and casualty insurance for all loss exposures not specifically financed within the self-insured programs. Loss exposures which are potentially catastrophic in nature, such as property and boiler machinery and airport liability, as well as specific specialty coverages, including fidelity bonds, fire/police death benefits, and excess Workers’ Compensation are currently financed through commercial insurance. The City’s Comprehensive Annual Financial Report annually includes a Schedule of Insurance, reporting the types and coverages of the City’s insurance, both commercially purchased and self-insured. Insurance Advisory Board
City Commission Policy 216 also provides for the creation of an Insurance Advisory Board (IAB). The IAB was established in 1955 and consists of five members from the local commercial insurance community, appointed by the City Commission to serve staggered three-year terms. In conjunction with Risk Management, and at the direction of the City Treasurer-Clerk, the IAB is responsible for input into the development, release, and evaluation of requests for proposals designed to elicit responses from the
4
Risk Management Self-Insurance Programs commercial insurance marketplace for coverage options and premium quotations. According to Policy 216, a joint recommendation for the selection and award of coverages shall be agendaed by the Risk Management staff and the IAB for City Commission consideration and approval. Additional Risk Management Responsibilities In addition to the administration of the City’s self-insured programs and commercially purchased insurance for all other applicable City exposures, Risk Management establishes, consults, and reviews insurance requirements for all City contracts, agreements, requests for proposals, and special events to ensure that the City is adequately protected.
1. Periodic reconciliations of the detailed subsidiary data in the RiskMaster system to the summary information in the City’s major systems, i.e., the PeopleSoft Financials (Financials) system and the CORE cashiering system, are not being performed. Revenues are recorded in three separate systems. First, collections related to claims are received in the Risk Management Division. Deposit logs are maintained and the logs and payments are transferred to the Revenue Division for deposit and entry into the City’s cashiering system (CORE). The collections recorded in CORE are summarized and systematically uploaded into the Financials system. Additionally, Risk Management staff also separately records the collections in the RiskMaster system. The data should be the same in all systems; however, the data can be different due to manual adjustments made in one of the systems, but not the others. Claims disbursements are recorded in two separate systems. First, detailed claims payment transactions originating in Risk Management are recorded in the RiskMaster system and then the transactions are uploaded into the Financials system. Checks are then created and distributed from the Financials system. Risk Management staff has not performed any steps to periodically reconcile the RiskMaster payment transactions to the Financials system payment transactions and total disbursements during the year. Since the information is manually input into the RiskMaster system in separate processes, there is an increased risk that the information may not be the same in each of the systems. For example, a manual adjustment may be made in one of the City’s main
5
Audit Report #1010
systems to void a transaction, but that transaction may not also be voided in the RiskMaster system. During our review, we performed audit procedures to reconcile the collections data in the three systems, the RiskMaster system, CORE system, and Financials system. The amounts identified as collections in RiskMaster appear to be materially complete and accurate when compared to the amounts collected and recorded in the CORE cashiering system and as recorded in the Financials system. Table 3 below shows we determined there was only a 2% difference between recorded collections in the RiskMaster and CORE systems and 1% difference between recorded collections in the RiskMaster and Financials systems.
Table 3 FY 2008 Collections Recorded in the RiskMaster, CORE, and PeopleSoft Financials Systems
RiskMaster Collections $ 322,176 CORE Collections $ 314,519 $ (7,657.26) -2% PS Financials Collections $ 319,742 $ (2,434.67) -1% Source: The RiskMaster system, CORE cashiering system, and Financials system. Additionally, we performed audit procedures to reconcile the payment data in the RiskMaster system and the Financials system for FY 2008. We found that the FY 2008 amounts identified as payments in RiskMaster appear to be materially complete and accurate when compared to payments as recorded in the Financials system and on the City's FY 2008 Accounting Report. Table 4 below shows that we determined there was a .04% difference between recorded payments in the RiskMaster and Financials systems.
Audit Report #1010
Table 4 FY 2008 Payments Recorded in the RiskMaster and Financials Systems
FY2008
System
System
Payments Recorded in RiskMaster $ 4,119,805.40 Payments Recorded in Financials (includes year-end adjustments) 0.04% 1,802.33 $ $ 4,121,607.73 Note: Differences may be due to manual adjustments being made in the Financials system (e.g., a voided transaction), but not made in the RiskMaster system.
Our tests indicated that there were no material differences between the RiskMaster system and the City’s major systems (Financials system and CORE cashiering system). Even so, reconciliation of these related systems is an important and necessary internal control activity. Therefore, we recommend that staff perform periodic reconciliations of the data in the involved systems in order to identify and correct any discrepancies in a timely manner.
2. Risk Management has not established controls sufficient to ensure that all collections will be promptly and properly recorded and deposited. Risk Management pursues recovery and subrogation against third parties responsible for damaging City assets and those collections are received as checks in the Risk Management office. During the audit period (October 2005 through March 2009) Risk Management reported collections of $1,143,834, an average of $326,810 per year. These checks, along with checks from other sources, are received in the City mailroom and provided unopened to Risk Management for processing. However, Risk Management has not established controls sufficient to ensure that all collections will be promptly and properly recorded and deposited, as the receipt of checks by Risk Management is not always immediately documented and the checks are not always immediately processed for deposit. When mail is received and opened in the Risk Management office, the receipt of the checks is not immediately documented. The checks are first provided to Risk Management staff determined to be responsible for the specific claims. Staff members
6
Risk Management Self-Insurance Programs
research each claim to determine whether the amount received is correct. After the review/research is completed, checks that are determined to be for the correct amounts are then recorded, prepared for deposit, and transferred to the Revenue Office.
All checks determined to be for incorrect or insufficient amounts are returned to the senders, along with a cover letter prepared by the staff person responsible for the specific claim explaining why the check is being returned. Notes are made in the applicable RiskMaster claim file indicating that the check has been returned, although no check log is maintained for these checks documenting the receipt and/or disposition of the checks.
Internal control guidelines have been established for the City through Administrative Policy and Procedure No. 630. These guidelines identify various control activities that should be considered by City departments in the establishment of internal control systems to protect and account for City assets. The Guidelines indicate, among various controls, that cash collection activity should be recorded on a timely basis and documented from the point of receipt through deposit. With no documentation of total receipts being maintained and not all checks being immediately deposited, checks could be diverted without timely detection by management. Therefore, we recommend that Risk Management establish controls over the receipt of all checks to provide for timely processing and deposit of all collections.
3. There is a lack of segregation of duties related to users of the RiskMaster system that allows single individuals to access the system and perform actions that create, update, and approve payment transactions. As discussed above in the background section, Risk Management accounts for all claims activity in the RiskMaster system. Within the RiskMaster system, access controls are available and are designed to limit a single individual’s access to conflicting activities such as allowing any one individual to both create and approve payments. In Risk Management, three individuals have been assigned access to the system that allows them to create, update, and approve payment transactions. These are the Risk Manager, Risk Management Systems and Services Supervisor, and the Administrative Specialist. When a user has the capability to create, update, and approve payments, there is an increased risk that the user may create and approve an unauthorized
Risk Management Self-Insurance Programs transaction that may not be detected in a timely manner. The Risk Management Division is small and therefore may encounter limitations preventing them from separating each duty, however, we recommend that management re-evaluate the risks associated with this user access and determine if there are adequate compensating controls to mitigate the identified risks. Note: Risk Management staff indicated that the City will be updating to a new version of RiskMaster during this year and there is new functionality that staff should evaluate that may allow them to implement additional controls. 4. There is a lack of accountability and segregation of duties due to the sharing of the system administrator user identification (Id) numbers and passwords.
Established Treasurer-Clerk/Risk Management procedures prohibit the sharing of passwords. Specifically, the procedures state “passwords shall be kept confidential and will not be shared among employees.... At no time shall one employee login and perform functions using another employee’s login user name and password. Additionally, City information security policies (APP #809, page 30) also prohibit employees from sharing user Ids and passwords. The Risk Management system supervisor (supervisor) is the assigned RiskMaster system administrator, and his backup is the administrative specialist I. The supervisor has been sharing his RiskMaster system user Id and password with the administrative specialist to allow the administrative specialist to perform the supervisor/system administrator duties when he is out of the office. The sharing of the supervisor/system administrator Id and password creates the following two issues: 1) There is a lack of accountability for who performs what functions and activities in the RiskMaster system as the supervisor/system administrator, as it will always appear in the logs that the supervisor/system administrator had performed the functions. 2) The administrative specialist I, when logged in as the system administrator, can then also create, update, and approve payment transactions, and it will appear as if the supervisor/system administrator had performed the functions. When a user has the capability of performing functions under another user's Id there is an increased risk that unauthorized functions and transactions could be performed that may not be detected in a timely manner. Management indicated that the system was set up this way due to the costs associated with the RiskMaster licenses. Each user Id requires a purchased license.
7
Audit Report #1010
Additionally, the small size of the office limits management’s ability to adequately separate all duties, and some staff need to perform duties that create a lack of segregation of duties. Risk Management managers believe that there are adequate compensating controls in place to mitigate the associated risks. We recommend that management re-evaluate the risks associated with this user access and the compensating controls to mitigate the associated risks. Additionally, we recommend that the administrative specialist I be assigned a separate user Id and password with only the additional access capabilities required to perform necessary backup functions, along with a report or log that can be reviewed by management to see which activities are being performed by someone other than the system administrator. As previously noted, the City will be updating to a new version of RiskMaster during this year and there is new functionality that staff should evaluate to implement these additional controls.
5. Vehicle accident subrogation collections from third parties are not being credited directly or equitably to the department originally sustaining the loss and paying the costs associated with the repair of damaged City vehicles and other City property. As discussed above in the background section of this report, subrogation is a term used in the insurance industry to describe an insurance carrier’s right to recover monies paid to, or on behalf of, its policy holder. In conjunction with the City’s self-insurance programs, Risk Management pursues recovery and subrogation against third parties responsible for damaging City assets. As noted above in Table 2, more than $1.1 million was recovered during our audit period through efforts of the Risk Management staff. Unlike Workers’ Compensation claims expense and general claims expense, which are both paid directly from the Risk Management Fund, vehicle accident claims expense associated with the repair of damaged City vehicles and/or other property, is paid by the department to which a vehicle has been assigned (or by the vehicle driver’s assigned department, if different from the department to which the vehicle was assigned). If a City vehicle is totaled and cannot be repaired, replacement of the vehicle is paid through the Fleet Management Reserve Fund (Fund 716). In either event, repairs or replacements are not paid from the Risk Management Fund. Based on the above, it would seem reasonable that the Treasurer-Clerk would return all vehicle accident
Audit Report #1010 subrogation collections directly to the Departments that originally pay for repairs or replacements of City vehicles or other property damaged in vehicle accidents. Such returned monies would be used to offset vehicle repair or replacement cost incurred when a third party is at fault in a vehicle accident. Instead, currently, the Treasurer-Clerk deposits all subrogation collections (i.e., Workers’ Compensation, general liability, and vehicle accident) into the Risk Management Fund even though costs paid for the repair or replacement of City vehicles and property is not originally paid from the Risk Management Fund. General discussions with the respective departments have indicated that departments sustaining vehicle losses would prefer to have a direct credit for any recoveries of vehicle repair cost (i.e., collections of vehicle repair cost). These vehicle subrogation collections are recorded by the Treasurer-Clerk (i.e., Risk Management) in the Risk Management Fund as Other Miscellaneous Revenue and are not identified as being owed back to the Departments that pay for vehicle repairs/replacements or damages to other property sustained as a result of a vehicle accident. At year-end, Risk Management provides Budget with a listing, by claim type, of all subrogation collections received on behalf of each department with the anticipation that Budget will use the listing to reduce expenses allocated to the respective departments in the subsequent year. We have determined, and Budget has verified, that they use the listing for "statistics", but not for purposes of reducing costs allocated to departments. It appears that at the time of our audit, neither Risk Management nor Budget had a joint understanding of how subrogation collections would be handled. In that Budget has not used the listing to adjust costs allocated to Departments, there is one more step in the process where recognition of third party subrogation collections can occur. At year-end, the DMA Accounting Services Manager makes a year-end close out adjustment to each Department based on the net overall gain or loss of the Risk Management Fund. The weakness in this closeout procedure is the calculation of a net gain or loss of the fund only considers total revenues and total expenditures. As a result, subrogation collections recorded as miscellaneous revenue are considered in the overall gain or loss calculation for the Risk Management Fund as a whole and without regard to subrogation collections made on behalf of a particular department. As a result, there are at least two issues that have resulted in Departments not receiving a direct or an
8
Risk Management Self-Insurance Programs
equitable allocation of subrogation collections related to vehicle accidents: 1. Subrogation collections received by Risk Management have not been returned to the Departments incurring the cost of repairs or replacement of their vehicles or other property. The current cost allocation process has not overcome this lack of direct transfer of subrogation collections back to the Department that repaired or replaced the damaged vehicle or other property. 2. The year-end closeout process was not designed or envisioned to address issues raised when vehicle accident subrogation collections are deposited into the Risk Management Fund. The closeout process treats all subrogation collections as a whole without regard to collections made on behalf of a specific department. We have discussed this issue with the Treasurer-Clerk and the Director of the Department of Management and Administration. They have agreed that in the future, vehicle accident subrogation collections received by the Treasurer -Clerk will be returned (i.e., credited) directly to departments identified with the incident. This revised process, when implemented, will address the above concerns and also eliminate the need to consider these collections in the cost allocation and closeout process. Appendix B illustrates the current process established to account for subrogation collections. Additionally, review of accounting records indicates that the Electric Department has been allowed to have a separate policy to receive direct credit for property losses due to vehicle accidents (when third parties are at fault) through the Risk Management Fund. This policy allows the Electric Department, contrary to the policy established for all other City departments, to immediately recover the full cost of damages to City property, other than to City vehicles, sustained as a result of third party vehicle accidents. The intent was that a subsequent annual reconciliation of recovered costs vs. not recovered costs would be performed by DMA with assistance from the Risk Management staff. However, the annual reconciliations were not performed resulting in a benefit to Electric. The effect of the above is that as implemented, the Electric Department has received 100% of the amount of their losses of City property other than vehicles when subrogation is involved even though those collections are normally for an amount that is less than the loss. In addition, when the Risk Management Fund has a net profit, the Electric Department also unfairly shares in the distribution of profits back to all City
Risk Management Self-Insurance Programs departments through the closeout process. In fairness to the Electric Department, the process described above was approved by the Office of the Treasurer-Clerk and DMA. However, as implemented, the process resulted in unintended negative consequences for other City departments. Over the past two fiscal years, this policy has resulted in direct charges by the Electric Department to the Risk Management Fund, Other Miscellaneous Revenue, of $360,285, an average of $180,142 per fiscal year, while actual subrogation collections by Risk Management for these losses of City property, other than City vehicles, caused by third party vehicle accidents averaged approximately only $72,400 per year over three fiscal years. We recommend that the Treasurer-Clerk and DMA prepare an analysis and take corrective actions for overpayments to the Electric Department and corresponding underpayments to other Departments since the adoption of the above-described policy. We also recommend that Risk Management and DMA staff develop and implement a transparent and equitable methodology to account for and distribute subrogation collections for losses to City property and vehicles sustained as a result of third party accidents, to applicable departments. In preliminary discussions between DMA and the Treasurer-Clerk’s Office there appears to be agreement that in the future, third party subrogation collections for damages to City property and vehicles as a result of vehicle accidents, will be returned directly to the department incurring the loss. 6. The Insurance Advisory Board (IAB) is currently inactive, limiting the City Treasurer-Clerk’s ability to comply with the City Commission policy requiring the IAB to have input when obtaining commercial insurance for the City of Tallahassee. City Commission Policy 216,Insurance Procurement Policy, requires Risk Management, as directed by the City Treasurer-Clerk and in conjunction with the Insurance Advisory Board (IAB), to procure the City’s commercial insurance coverages for all loss exposures not specifically financed within the City’s self-insurance program, through a Request for Proposal (RFP) process. These RFPs are developed and released to all interested commercial insurance agents, brokers and underwriters and are designed to elicit responses from the commercial insurance marketplace for available coverage options and premium quotations. When received, RFP responses are to be evaluated by the Risk Management staff and the IAB to determine the best coverage options and premium quotes to meet the City's commercial insurance needs.
9
Audit Report #1010
Currently, according to Risk Management staff, the IAB is not active, and therefore, not available to provide input and recommendations to Risk Management regarding insurance coverages and premiums most economical and beneficial for City purposes. The last IAB meeting was held on April 9, 2008. Risk Management staff has indicated that it has been difficult to find qualified, independent individuals necessary to serve on the IAB as the individuals must not only be knowledgeable of the insurance profession, but must also be independent of any business relationship, or desired business relationship, with the City. We recommend that the City Treasurer-Clerk, along with Risk Management, evaluate the benefits of the contributions of an active IAB. If it is determined that an active IAB cannot be maintained, changes to City Commission Policy 216 should be made to more accurately reflect the current commercial insurance procurement process, eliminating the involvement of the IAB. If it is determined that an IAB is desirable and necessary in the procurement of the City’s commercial insurance coverages, efforts should be made to seek qualified individuals sufficient to allow the IAB to function as an active, contributing entity in the commercial insurance procurement process.
7. Performance data is not being accumulated to allow City management the opportunity to analyze and report Risk Management’s efficiencies and productivity in the accomplishment of responsibilities related to the Risk Management function. Performance measures are important tools for identifying goals and assessing and verifying their achievement. While program objectives have been established for the Risk Management division, as reported in the City’s fiscal year 2009 Approved Budget, input, output, and efficiency measures have not been developed for Risk Management. The City’s internal control guidelines indicate that performance indicators serve as a control feature to provide management with a way to analyze operating and/or financial data to assess and evaluate operations [APP 630,Internal Control Guidelines]. With appropriate performance measures in place, management will be provided useful information to assist them in focusing decisions and activities on clear and measurable results toward meeting the goals of the City’s self-insurance program. We recommend that the Risk Manager develop and implement quantifiable performance measures to assist in evaluating and reporting the efficiency and effectiveness of the risk
Audit Report #1010 management function. Such measures should consider resource requirements (inputs), and efficiency and effectiveness measures.
In our audit of the processes in place to ensure accurate and reliable accounting for the City’s risk management function we determined that: •Transactions are generally input timely and accurately and •Data maintained through the self-insurance accounting system, RiskMaster, was reliable and reconcilable to two of the City’s major financial reporting systems, the Financials system and the CORE cashiering system. We did note several areas where controls could be strengthened and processes adopted to provide additional assurance of the reliability of the RiskMaster system data and effectiveness and efficiency of the risk management function. Those issues were discussed with the City Treasurer-Clerk and Risk Management staff and management’s planned corrective actions are provided in Appendix A.
We would like to acknowledge the full and complete cooperation and support of management and staff of the City Treasurer-Clerk’s Office and the Risk Management Division in the completion of this project.
10
Risk Management Self-Insurance Programs
City Treasurer-Clerk Response:
We are very pleased that the audit found that the Risk Management Division has established adequate controls over the claims disbursement and collection of the self-insurance program to protect and safeguard City assets. We also want to thank the Internal Audit staff for their input and assistance in resolving the long-standing issue regarding the equitable distribution of subrogation collections from third parties to the department originally sustaining the loss. We now have a system in place that all departments involved believe will resolve this issue moving forward. City Manager eRps :noes
I am pleased with the results of this audit and am glad that overall the Risk Management Self Insurance programs are being administered efficiently and effectively. DMA staff will continue to work with Treasurer-Clerk staff to ensure that the action plan items listed will be resolved by the time frames identified. I would like to thank the City Auditor and his staff for their work on this audit.
